In the spirit of my original comment I'd answer "yes" to your last question. If I wanted a legal career I'd pursue that -- but I don't. So I'll cut my loses. That doesn't mean I am a shady operator, it means I don't want to risk being sued for money I don't have and likely end up in jail; in EU you can't just declare bankruptcy and run free afterwards.

Hobby or goodwill projects (==not turning a profit) just aren't worth that risk.

> in EU you can't just declare bankruptcy and run free afterwards.

Incorporate in the US?

Well, that's yet another legal black hole I don't want to fall into, but yours is still an excellent point.

I thought the gdpr applied to all EU citizens, even if they're not in the EU. If so filtering IP addresses isn't enough.

It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.

That's fairly contrary to how I've understood things. Can you provide a resource on that?

Here's one:

https://www.wileyrein.com/newsroom-newsletters-item-May_2017...

I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.

Ok, that does seem to be the consensus and a good reading of the law.

However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?

If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services.

Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience.

This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.

> 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

b. The monitoring of their behavior as far as their behavior takes place within the Union."

This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.

The official EU guidance (not in the text of the GDPR) clarifies what offering means - it requires some evidence of intent to target the EU, rather than merely not blocking the EU.

While that point of guidance won't have region-wide binding force of law unless the European Court of Justice rules that way, I'd be extremely surprised if any national supervising authority or court system would contradict such a document, since the official guidance's reading is clearly among the possibilities consistent with the text (admittedly not the only one) and predictability of this kind of law is key to achieving its goals. Even if they do, they wouldn't likely penalize people with more than a warning if they haven't announced their weird interpretation in advance.

This is an excellent example of the problems people are worried about though.

Q: is it possible to be in violation of the gdpr in a situation where you could never know you needed to be compliant and have taken steps to avoid serving EU countries?

A, official: Yes.

A, unofficial: Most likely not if no one's having a bad day or has a bone to pick or is just being uppity.

The official answer isn't necessarily yes, though. The official answer is more ambiguous than that - "offering" can mean what you think it means, but it can also mean what the official guidance says.

Also, both answers are official and from the EU institutions. One is the law, and the other is meant to help interpret and apply the law. I'm not talking about third party compliance guides (except for the link I shared), of which there are many.

With all of that said... If you have both taken steps to avoid serving EU countries AND have also done things which they view as targeting EU countries, the answer would be murkier. For example, if you block European IP addresses but also use .de and .fr IP addresses and accept Euros, they might consider it to apply despite the IP block.

I'm also not sure what would happen if you took no explicit steps to target, but saw 80% of your customers coming from Europe on a sustained basis and did nothing to stop that.

Overall, the law will be interpreted with its own intent in mind: it should apply if you're engaging with Europe, but not automatically globally.

I understand if you want more certainty, but that's how computer programs operate, not laws.

It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.

Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :)

The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".

I understand that Germany may impose criminal penalties for certain violations of the GDPR, maybe other countries too. In that case yes, you could get arrested changing planes in Frankfurt, and spend time in German prison. The probability of that of course seems very low.

An EU government could try to convince your own government to enforce their fine / injunction / extradition / whatever. I don't think the USA has any treaty or other law that would compel them to. I'd guess that Trump's administration would treat the request as something between a joke and an attack on American sovereignty, so I doubt that's a major risk here. Other countries may vary.

The easiest path for the EU to enforce is probably through your customers and vendors, probably starting with payment processors--like, require everyone who processes payments in the EU to transact only with people who transact only with GDPR-compliant companies. My personal guess is that everyone with a business model that depends on breaking the GDPR will move offshore, and the EU will play the same game of merchant account whack-a-mole that the USA does for online poker and such. I'd guess that the effort to enforce offshore will be big enough that only the most egregious violators will be worth the attention.

Pretty sure there is an extradition treaty [0], which the US makes use of to e.g. try and get British hackers extradited [1]. Such requests can be blocked (also [1]).

[0] http://ec.europa.eu/world/agreements/prepareCreateTreatiesWo...

[1] http://www.bbc.com/news/uk-england-42946540

Yeah, but extradition treaties generally require "dual criminality", that the offense be a crime in both countries. If your offense wasn't a crime in the USA, then you probably won't get extradited; and if it was, then the USA probably has jurisdiction too (assuming you were physically here when you did it), so the USA can prosecute you itself.

The link to Mr. Love's case, or Mr. Dotcom's ongoing case clearly show being "physically here" didn't seem to factor into those requests.

Fair, and my reply was unclear. I mean that if the act is a crime in both countries, then it's a crime in the USA, so you'd be committing a crime with or without the GDPR.

But none of this is new, as Sklyarov found out.